ansible-core 2.18.7rc1__py3-none-any.whl → 2.19.0__py3-none-any.whl

ansible/plugins/action/add_host.py

@@ -31,7 +31,7 @@ display = Display()
 
 
 class ActionModule(ActionBase):
-    ''' Create inventory hosts and groups in the memory inventory'''
+    """ Create inventory hosts and groups in the memory inventory"""
 
     # We need to be able to modify the inventory
     BYPASS_HOST_LOOP = True
@@ -77,7 +77,7 @@ class ActionModule(ActionBase):
             elif isinstance(groups, string_types):
                 group_list = groups.split(",")
             else:
-                raise AnsibleActionFail("Groups must be specified as a list.", obj=self._task)
+                raise AnsibleActionFail("Groups must be specified as a list.", obj=groups)
 
             for group_name in group_list:
                 if group_name not in new_groups:

ansible/plugins/action/assemble.py

@@ -25,8 +25,8 @@ import re
 import tempfile
 
 from ansible import constants as C
-from ansible.errors import AnsibleError, AnsibleAction, _AnsibleActionDone, AnsibleActionFail
-from ansible.module_utils.common.text.converters import to_native, to_text
+from ansible.errors import AnsibleActionFail
+from ansible.module_utils.common.text.converters import to_text
 from ansible.module_utils.parsing.convert_bool import boolean
 from ansible.plugins.action import ActionBase
 from ansible.utils.hashing import checksum_s
@@ -37,7 +37,7 @@ class ActionModule(ActionBase):
     TRANSFERS_FILES = True
 
     def _assemble_from_fragments(self, src_path, delimiter=None, compiled_regexp=None, ignore_hidden=False, decrypt=True):
-        ''' assemble a file from a directory of fragments '''
+        """ assemble a file from a directory of fragments """
 
         tmpfd, temp_path = tempfile.mkstemp(dir=C.DEFAULT_LOCAL_TMP)
         tmp = os.fdopen(tmpfd, 'wb')
@@ -81,9 +81,10 @@ class ActionModule(ActionBase):
 
     def run(self, tmp=None, task_vars=None):
 
-        self._supports_check_mode = False
+        self._supports_check_mode = True
+
+        super(ActionModule, self).run(tmp, task_vars)
 
-        result = super(ActionModule, self).run(tmp, task_vars)
         del tmp  # tmp no longer has any effect
 
         if task_vars is None:
@@ -104,13 +105,9 @@ class ActionModule(ActionBase):
 
             if boolean(remote_src, strict=False):
                 # call assemble via ansible.legacy to allow library/ overrides of the module without collection search
-                result.update(self._execute_module(module_name='ansible.legacy.assemble', task_vars=task_vars))
-                raise _AnsibleActionDone()
-            else:
-                try:
-                    src = self._find_needle('files', src)
-                except AnsibleError as e:
-                    raise AnsibleActionFail(to_native(e))
+                return self._execute_module(module_name='ansible.legacy.assemble', task_vars=task_vars)
+
+            src = self._find_needle('files', src)
 
             if not os.path.isdir(src):
                 raise AnsibleActionFail(u"Source (%s) is not a directory" % src)
@@ -153,13 +150,9 @@ class ActionModule(ActionBase):
                 res = self._execute_module(module_name='ansible.legacy.copy', module_args=new_module_args, task_vars=task_vars)
                 if diff:
                     res['diff'] = diff
-                result.update(res)
+                return res
             else:
-                result.update(self._execute_module(module_name='ansible.legacy.file', module_args=new_module_args, task_vars=task_vars))
+                return self._execute_module(module_name='ansible.legacy.file', module_args=new_module_args, task_vars=task_vars)
 
-        except AnsibleAction as e:
-            result.update(e.result)
         finally:
             self._remove_tmp_path(self._connection._shell.tmpdir)
-
-        return result

ansible/plugins/action/assert.py

@@ -16,19 +16,41 @@
 # along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
 from __future__ import annotations
 
-from ansible.errors import AnsibleError
-from ansible.playbook.conditional import Conditional
+import typing as t
+
+from ansible._internal._templating import _jinja_bits
+from ansible.errors import AnsibleTemplateError
+from ansible.module_utils.common.validation import _check_type_list_strict
 from ansible.plugins.action import ActionBase
-from ansible.module_utils.six import string_types
-from ansible.module_utils.parsing.convert_bool import boolean
+from ansible._internal._templating._engine import TemplateEngine
 
 
 class ActionModule(ActionBase):
-    ''' Fail with custom message '''
+    """Assert that one or more conditional expressions evaluate to true."""
 
     _requires_connection = False
 
-    _VALID_ARGS = frozenset(('fail_msg', 'msg', 'quiet', 'success_msg', 'that'))
+    @classmethod
+    def finalize_task_arg(cls, name: str, value: t.Any, templar: TemplateEngine, context: t.Any) -> t.Any:
+        if name != 'that':
+            # `that` is the only key requiring special handling; delegate to base handling otherwise
+            return super().finalize_task_arg(name, value, templar, context)
+
+        if not isinstance(value, str):
+            # if `that` is not a string, we don't need to attempt to resolve it as a template before validation (which will also listify it)
+            return value
+
+        # if `that` is entirely a string template, we only want to resolve to the container and avoid templating the container contents
+        if _jinja_bits.is_possibly_all_template(value):
+            try:
+                templated_that = templar.resolve_to_container(value)
+            except AnsibleTemplateError:
+                pass
+            else:
+                if isinstance(templated_that, list):  # only use `templated_that` if it is a list
+                    return templated_that
+
+        return value
 
     def run(self, tmp=None, task_vars=None):
         if task_vars is None:
@@ -37,70 +59,26 @@ class ActionModule(ActionBase):
         result = super(ActionModule, self).run(tmp, task_vars)
         del tmp  # tmp no longer has any effect
 
-        if 'that' not in self._task.args:
-            raise AnsibleError('conditional required in "that" string')
-
-        fail_msg = None
-        success_msg = None
-
-        fail_msg = self._task.args.get('fail_msg', self._task.args.get('msg'))
-        if fail_msg is None:
-            fail_msg = 'Assertion failed'
-        elif isinstance(fail_msg, list):
-            if not all(isinstance(x, string_types) for x in fail_msg):
-                raise AnsibleError('Type of one of the elements in fail_msg or msg list is not string type')
-        elif not isinstance(fail_msg, (string_types, list)):
-            raise AnsibleError('Incorrect type for fail_msg or msg, expected a string or list and got %s' % type(fail_msg))
-
-        success_msg = self._task.args.get('success_msg')
-        if success_msg is None:
-            success_msg = 'All assertions passed'
-        elif isinstance(success_msg, list):
-            if not all(isinstance(x, string_types) for x in success_msg):
-                raise AnsibleError('Type of one of the elements in success_msg list is not string type')
-        elif not isinstance(success_msg, (string_types, list)):
-            raise AnsibleError('Incorrect type for success_msg, expected a string or list and got %s' % type(success_msg))
-
-        quiet = boolean(self._task.args.get('quiet', False), strict=False)
-
-        # directly access 'that' via untemplated args from the task so we can intelligently trust embedded
-        # templates and preserve the original inputs/locations for better messaging on assert failures and
-        # errors.
-        # FIXME: even in devel, things like `that: item` don't always work properly (truthy string value
-        # is not really an embedded expression)
-        # we could fix that by doing direct var lookups on the inputs
-        # FIXME: some form of this code should probably be shared between debug, assert, and
-        # Task.post_validate, since they
-        # have a lot of overlapping needs
-        try:
-            thats = self._task.untemplated_args['that']
-        except KeyError:
-            # in the case of "we got our entire args dict from a template", we can just consult the
-            # post-templated dict (the damage has likely already been done for embedded templates anyway)
-            thats = self._task.args['that']
-
-        # FIXME: this is a case where we only want to resolve indirections, NOT recurse containers
-        # (and even then, the leaf-most expression being wrapped is at least suboptimal
-        # (since its expression will be "eaten").
-        if isinstance(thats, str):
-            thats = self._templar.template(thats)
-
-        # make sure the 'that' items are a list
-        if not isinstance(thats, list):
-            thats = [thats]
-
-        # Now we iterate over the that items, temporarily assigning them
-        # to the task's when value so we can evaluate the conditional using
-        # the built in evaluate function. The when has already been evaluated
-        # by this point, and is not used again, so we don't care about mangling
-        # that value now
-        cond = Conditional(loader=self._loader)
+        validation_result, new_module_args = self.validate_argument_spec(
+            argument_spec=dict(
+                fail_msg=dict(type=str_or_list_of_str, aliases=['msg'], default='Assertion failed'),
+                success_msg=dict(type=str_or_list_of_str, default='All assertions passed'),
+                quiet=dict(type='bool', default=False),
+                # explicitly not validating types `elements` here to let type rules for conditionals apply
+                that=dict(type=_check_type_list_strict, required=True),
+            ),
+        )
+
+        fail_msg = new_module_args['fail_msg']
+        success_msg = new_module_args['success_msg']
+        quiet = new_module_args['quiet']
+        that_list = new_module_args['that']
+
         if not quiet:
             result['_ansible_verbose_always'] = True
 
-        for that in thats:
-            cond.when = [that]
-            test_result = cond.evaluate_conditional(templar=self._templar, all_vars=task_vars)
+        for that in that_list:
+            test_result = self._templar.evaluate_conditional(conditional=that)
             if not test_result:
                 result['failed'] = True
                 result['evaluated_to'] = test_result
@@ -113,3 +91,13 @@ class ActionModule(ActionBase):
         result['changed'] = False
         result['msg'] = success_msg
         return result
+
+
+def str_or_list_of_str(value: t.Any) -> str | list[str]:
+    if isinstance(value, str):
+        return value
+
+    if not isinstance(value, list) or any(not isinstance(item, str) for item in value):
+        raise TypeError("a string or list of strings is required")
+
+    return value

ansible/plugins/action/async_status.py

@@ -28,7 +28,7 @@ class ActionModule(ActionBase):
         )
 
         # initialize response
-        results['started'] = results['finished'] = 0
+        results['started'] = results['finished'] = False
         results['stdout'] = results['stderr'] = ''
         results['stdout_lines'] = results['stderr_lines'] = []
 
@@ -43,9 +43,14 @@ class ActionModule(ActionBase):
             results['erased'] = log_path
         else:
             results['results_file'] = log_path
-            results['started'] = 1
+            results['started'] = True
 
         new_module_args['_async_dir'] = async_dir
         results = merge_hash(results, self._execute_module(module_name='ansible.legacy.async_status', task_vars=task_vars, module_args=new_module_args))
 
+        # Backwards compat shim for when started/finished were ints,
+        # mostly to work with ansible.windows.async_status
+        for convert in ('started', 'finished'):
+            results[convert] = bool(results[convert])
+
         return results

ansible/plugins/action/copy.py

@@ -23,12 +23,11 @@ import os
 import os.path
 import stat
 import tempfile
-import traceback
 
 from ansible import constants as C
 from ansible.errors import AnsibleError, AnsibleActionFail, AnsibleFileNotFound
 from ansible.module_utils.basic import FILE_COMMON_ARGUMENTS
-from ansible.module_utils.common.text.converters import to_bytes, to_native, to_text
+from ansible.module_utils.common.text.converters import to_bytes, to_text
 from ansible.module_utils.parsing.convert_bool import boolean
 from ansible.plugins.action import ActionBase
 from ansible.utils.hashing import checksum
@@ -389,17 +388,15 @@ class ActionModule(ActionBase):
         return result
 
     def _create_content_tempfile(self, content):
-        ''' Create a tempfile containing defined content '''
+        """ Create a tempfile containing defined content """
         fd, content_tempfile = tempfile.mkstemp(dir=C.DEFAULT_LOCAL_TMP, prefix='.')
-        f = os.fdopen(fd, 'wb')
         content = to_bytes(content)
         try:
-            f.write(content)
+            with os.fdopen(fd, 'wb') as f:
+                f.write(content)
         except Exception as err:
             os.remove(content_tempfile)
             raise Exception(err)
-        finally:
-            f.close()
         return content_tempfile
 
     def _remove_tempfile_if_content_defined(self, content, content_tempfile):
@@ -407,11 +404,12 @@ class ActionModule(ActionBase):
             os.remove(content_tempfile)
 
     def run(self, tmp=None, task_vars=None):
-        ''' handler for file transfer operations '''
+        """ handler for file transfer operations """
         if task_vars is None:
             task_vars = dict()
 
         result = super(ActionModule, self).run(tmp, task_vars)
+
         del tmp  # tmp no longer has any effect
 
         # ensure user is not setting internal parameters
@@ -453,10 +451,10 @@ class ActionModule(ActionBase):
                 else:
                     content_tempfile = self._create_content_tempfile(content)
                 source = content_tempfile
-            except Exception as err:
-                result['failed'] = True
-                result['msg'] = "could not write content temp file: %s" % to_native(err)
-                return self._ensure_invocation(result)
+            except Exception as ex:
+                self._ensure_invocation(result)
+
+                raise AnsibleActionFail(message="could not write content temp file", result=result) from ex
 
         # if we have first_available_file in our vars
         # look up the files and use the first one we find as src
@@ -472,11 +470,10 @@ class ActionModule(ActionBase):
             try:
                 # find in expected paths
                 source = self._find_needle('files', source)
-            except AnsibleError as e:
-                result['failed'] = True
-                result['msg'] = to_text(e)
-                result['exception'] = traceback.format_exc()
-                return self._ensure_invocation(result)
+            except AnsibleError as ex:
+                self._ensure_invocation(result)
+
+                raise AnsibleActionFail(result=result) from ex
 
             if trailing_slash != source.endswith(os.path.sep):
                 if source[-1] == os.path.sep:

ansible/plugins/action/debug.py

@@ -17,29 +17,32 @@
 # along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
 from __future__ import annotations
 
-from ansible.errors import AnsibleUndefinedVariable
-from ansible.module_utils.six import string_types
-from ansible.module_utils.common.text.converters import to_text
+from ansible.errors import AnsibleValueOmittedError, AnsibleError
+from ansible.module_utils.common.validation import _check_type_str_no_conversion
 from ansible.plugins.action import ActionBase
+from ansible._internal._templating._jinja_common import UndefinedMarker, TruncationMarker
+from ansible._internal._templating._utils import Omit
+from ansible._internal._templating._marker_behaviors import ReplacingMarkerBehavior, RoutingMarkerBehavior
+from ansible.utils.display import Display
+
+display = Display()
 
 
 class ActionModule(ActionBase):
-    ''' Print statements during execution '''
+    """
+    Emits informational messages, with special diagnostic handling of some templating failures.
+    """
 
     TRANSFERS_FILES = False
-    _VALID_ARGS = frozenset(('msg', 'var', 'verbosity'))
     _requires_connection = False
 
     def run(self, tmp=None, task_vars=None):
-        if task_vars is None:
-            task_vars = dict()
-
         validation_result, new_module_args = self.validate_argument_spec(
-            argument_spec={
-                'msg': {'type': 'raw', 'default': 'Hello world!'},
-                'var': {'type': 'raw'},
-                'verbosity': {'type': 'int', 'default': 0},
-            },
+            argument_spec=dict(
+                msg=dict(type='raw', default='Hello world!'),
+                var=dict(type=_check_type_str_no_conversion),
+                verbosity=dict(type='int', default=0),
+            ),
             mutually_exclusive=(
                 ('msg', 'var'),
             ),
@@ -51,31 +54,34 @@ class ActionModule(ActionBase):
         # get task verbosity
         verbosity = new_module_args['verbosity']
 
+        replacing_behavior = ReplacingMarkerBehavior()
+
+        var_behavior = RoutingMarkerBehavior({
+            UndefinedMarker: replacing_behavior,
+            TruncationMarker: replacing_behavior,
+        })
+
         if verbosity <= self._display.verbosity:
-            if new_module_args['var']:
+            if raw_var_arg := new_module_args['var']:
+                # If var name is same as result, try to template it
                 try:
-                    results = self._templar.template(new_module_args['var'], convert_bare=True, fail_on_undefined=True)
-                    if results == new_module_args['var']:
-                        # if results is not str/unicode type, raise an exception
-                        if not isinstance(results, string_types):
-                            raise AnsibleUndefinedVariable
-                        # If var name is same as result, try to template it
-                        results = self._templar.template("{{" + results + "}}", convert_bare=True, fail_on_undefined=True)
-                except AnsibleUndefinedVariable as e:
-                    results = u"VARIABLE IS NOT DEFINED!"
-                    if self._display.verbosity > 0:
-                        results += u": %s" % to_text(e)
-
-                if isinstance(new_module_args['var'], (list, dict)):
-                    # If var is a list or dict, use the type as key to display
-                    result[to_text(type(new_module_args['var']))] = results
-                else:
-                    result[new_module_args['var']] = results
+                    results = self._templar._engine.extend(marker_behavior=var_behavior).evaluate_expression(raw_var_arg)
+                except AnsibleValueOmittedError as ex:
+                    results = repr(Omit)
+                    display.warning("The result of the `var` expression could not be omitted; a placeholder was used instead.", obj=ex.obj)
+                except Exception as ex:
+                    raise AnsibleError('Error while resolving `var` expression.', obj=raw_var_arg) from ex
+
+                result[raw_var_arg] = results
             else:
                 result['msg'] = new_module_args['msg']
 
             # force flag to make debug output module always verbose
             result['_ansible_verbose_always'] = True
+
+            # propagate any warnings in the task result unless we're skipping the task
+            replacing_behavior.emit_warnings()
+
         else:
             result['skipped_reason'] = "Verbosity threshold not met."
             result['skipped'] = True

ansible/plugins/action/dnf.py

@@ -30,10 +30,9 @@ class ActionModule(ActionBase):
 
         if module in {'yum', 'auto'}:
             try:
-                if self._task.delegate_to:  # if we delegate, we should use delegated host's facts
-                    module = self._templar.template("{{hostvars['%s']['ansible_facts']['pkg_mgr']}}" % self._task.delegate_to)
-                else:
-                    module = self._templar.template("{{ansible_facts.pkg_mgr}}")
+                # if we delegate, we should use delegated host's facts
+                expr = "hostvars[delegate_to].ansible_facts.pkg_mgr" if self._task.delegate_to else "ansible_facts.pkg_mgr"
+                module = self._templar.resolve_variable_expression(expr, local_variables=dict(delegate_to=self._task.delegate_to))
             except Exception:
                 pass  # could not get it from template!
 

ansible/plugins/action/fail.py

@@ -21,7 +21,7 @@ from ansible.plugins.action import ActionBase
 
 
 class ActionModule(ActionBase):
-    ''' Fail with custom message '''
+    """ Fail with custom message """
 
     TRANSFERS_FILES = False
     _VALID_ARGS = frozenset(('msg',))

ansible/plugins/action/fetch.py

@@ -33,7 +33,7 @@ display = Display()
 class ActionModule(ActionBase):
 
     def run(self, tmp=None, task_vars=None):
-        ''' handler for fetch operations '''
+        """ handler for fetch operations """
         if task_vars is None:
             task_vars = dict()
 
@@ -51,7 +51,7 @@ class ActionModule(ActionBase):
             validate_checksum = boolean(self._task.args.get('validate_checksum', True), strict=False)
 
             msg = ''
-            # validate source and dest are strings FIXME: use basic.py and module specs
+            # FIXME: validate source and dest are strings; use basic.py and module specs
             if not isinstance(source, string_types):
                 msg = "Invalid type supplied for source option, it must be a string"
 
@@ -119,7 +119,7 @@ class ActionModule(ActionBase):
 
                     if 'not found' in slurpres.get('msg', ''):
                         result['msg'] = "the remote file does not exist, not transferring, ignored"
-                    elif slurpres.get('msg', '').startswith('source is a directory'):
+                    elif slurpres.get('msg', '').lower().startswith('source is a directory'):
                         result['msg'] = "remote file is a directory, fetch cannot work on directories"
 
                     return result
@@ -178,11 +178,10 @@ class ActionModule(ActionBase):
                     self._connection.fetch_file(source, dest)
                 else:
                     try:
-                        f = open(to_bytes(dest, errors='surrogate_or_strict'), 'wb')
-                        f.write(remote_data)
-                        f.close()
-                    except (IOError, OSError) as e:
-                        raise AnsibleActionFail("Failed to fetch the file: %s" % e)
+                        with open(to_bytes(dest, errors='surrogate_or_strict'), 'wb') as f:
+                            f.write(remote_data)
+                    except OSError as ex:
+                        raise AnsibleActionFail("Failed to fetch the file.") from ex
                 new_checksum = secure_hash(dest)
                 # For backwards compatibility. We'll return None on FIPS enabled systems
                 try:

ansible/plugins/action/gather_facts.py

@@ -9,10 +9,11 @@ import typing as t
 
 from ansible import constants as C
 from ansible.errors import AnsibleActionFail
-from ansible.executor.module_common import get_action_args_with_defaults
+from ansible.executor.module_common import _apply_action_arg_defaults
 from ansible.module_utils.parsing.convert_bool import boolean
 from ansible.plugins.action import ActionBase
 from ansible.utils.vars import merge_hash
+from ansible._internal._errors import _error_utils
 
 
 class ActionModule(ActionBase):
@@ -28,10 +29,8 @@ class ActionModule(ActionBase):
 
             # TODO: remove in favor of controller side argspec detecting valid arguments
             # network facts modules must support gather_subset
-            try:
-                name = self._connection.ansible_name.removeprefix('ansible.netcommon.')
-            except AttributeError:
-                name = self._connection._load_name.split('.')[-1]
+            name = self._connection.ansible_name.removeprefix('ansible.netcommon.')
+
             if name not in ('network_cli', 'httpapi', 'netconf'):
                 subset = mod_args.pop('gather_subset', None)
                 if subset not in ('all', ['all'], None):
@@ -54,10 +53,7 @@ class ActionModule(ActionBase):
             fact_module, collection_list=self._task.collections
         ).resolved_fqcn
 
-        mod_args = get_action_args_with_defaults(
-            resolved_fact_module, mod_args, self._task.module_defaults, self._templar,
-            action_groups=self._task._parent._play._action_groups
-        )
+        mod_args = _apply_action_arg_defaults(resolved_fact_module, self._task, mod_args, self._templar)
 
         return mod_args
 
@@ -93,7 +89,7 @@ class ActionModule(ActionBase):
             if set(modules).intersection(set(C._ACTION_SETUP)):
                 # most don't realize how setup works with networking connection plugins (forced_local)
                 self._display.warning("Detected 'setup' module and a network OS is set, the output when running it will reflect 'localhost'"
-                                      " and not the target when a netwoking connection plugin is used.")
+                                      " and not the target when a networking connection plugin is used.")
 
         elif not set(modules).intersection(set(C._ACTION_SETUP)):
             # no network OS and setup not in list, add setup by default since 'smart'
@@ -162,7 +158,7 @@ class ActionModule(ActionBase):
                 for module in jobs:
                     poll_args = {'jid': jobs[module]['ansible_job_id'], '_async_dir': os.path.dirname(jobs[module]['results_file'])}
                     res = self._execute_module(module_name='ansible.legacy.async_status', module_args=poll_args, task_vars=task_vars, wrap_async=False)
-                    if res.get('finished', 0) == 1:
+                    if res.get('finished', False):
                         if res.get('failed', False):
                             failed[module] = res
                         elif res.get('skipped', False):
@@ -181,16 +177,19 @@ class ActionModule(ActionBase):
             self._task.async_val = async_val
 
         if skipped:
-            result['msg'] = "The following modules were skipped: %s\n" % (', '.join(skipped.keys()))
+            result['msg'] = f"The following modules were skipped: {', '.join(skipped.keys())}."
             result['skipped_modules'] = skipped
             if len(skipped) == len(modules):
                 result['skipped'] = True
 
         if failed:
-            result['failed'] = True
-            result['msg'] = "The following modules failed to execute: %s\n" % (', '.join(failed.keys()))
             result['failed_modules'] = failed
 
+            result.update(_error_utils.result_dict_from_captured_errors(
+                msg=f"The following modules failed to execute: {', '.join(failed.keys())}.",
+                errors=[r['exception'] for r in failed.values()],
+            ))
+
         # tell executor facts were gathered
         result['ansible_facts']['_ansible_facts_gathered'] = True
 

ansible/plugins/action/group_by.py

@@ -21,7 +21,7 @@ from ansible.module_utils.six import string_types
 
 
 class ActionModule(ActionBase):
-    ''' Create inventory groups based on variables '''
+    """ Create inventory groups based on variables """
 
     # We need to be able to modify the inventory
     TRANSFERS_FILES = False

ansible/plugins/action/include_vars.py

@@ -9,8 +9,9 @@ import pathlib
 
 import ansible.constants as C
 from ansible.errors import AnsibleError
+from ansible._internal._datatag._tags import SourceWasEncrypted
 from ansible.module_utils.six import string_types
-from ansible.module_utils.common.text.converters import to_native, to_text
+from ansible.module_utils.common.text.converters import to_native
 from ansible.plugins.action import ActionBase
 from ansible.utils.vars import combine_vars
 
@@ -142,9 +143,8 @@ class ActionModule(ActionBase):
             result['message'] = err_msg
         elif self.hash_behaviour is not None and self.hash_behaviour != C.DEFAULT_HASH_BEHAVIOUR:
             merge_hashes = self.hash_behaviour == 'merge'
-            for key, value in results.items():
-                old_value = task_vars.get(key, None)
-                results[key] = combine_vars(old_value, value, merge=merge_hashes)
+            existing_variables = {k: v for k, v in task_vars.items() if k in results}
+            results = combine_vars(existing_variables, results, merge=merge_hashes)
 
         result['ansible_included_var_files'] = self.included_files
         result['ansible_facts'] = results
@@ -168,9 +168,9 @@ class ActionModule(ActionBase):
                 )
                 self.source_dir = path_to_use
         else:
-            if hasattr(self._task._ds, '_data_source'):
+            if (origin := self._task._origin) and origin.path:  # origin.path is not present for ad-hoc tasks
                 current_dir = (
-                    "/".join(self._task._ds._data_source.split('/')[:-1])
+                    "/".join(origin.path.split('/')[:-1])
                 )
                 self.source_dir = path.join(current_dir, self.source_dir)
 
@@ -234,14 +234,13 @@ class ActionModule(ActionBase):
             failed = True
             err_msg = ('{0} does not have a valid extension: {1}'.format(to_native(filename), ', '.join(self.valid_extensions)))
         else:
-            b_data, show_content = self._loader._get_file_contents(filename)
-            data = to_text(b_data, errors='surrogate_or_strict')
+            data = self._loader.load_from_file(filename, cache='none', trusted_as_template=True)
 
-            self.show_content &= show_content  # mask all results if any file was encrypted
+            self.show_content &= not SourceWasEncrypted.is_tagged_on(data)
 
-            data = self._loader.load(data, file_name=filename, show_content=show_content)
-            if not data:
+            if data is None:  # support empty files, but not falsey values
                 data = dict()
+
             if not isinstance(data, dict):
                 failed = True
                 err_msg = ('{0} must be stored as a dictionary/hash'.format(to_native(filename)))